Download

There are three different packages for each TSK release.

• sleuthkit-X.X.X.tar.gz: This is the source code release of TSK core and framework that you must compile on your computer. This is most commonly used on non-windows systems.
• sleuthkit-win32-X.X.X.zip: This is the compiled windows release of TSK core. This has executables and libraries that allow you to run this on windows.
• sleuthkit-framework-X.X.X-win32-X.X.X.zip: This is the compiled windows release of the framework. It has the tsk_analyzeimg program that allows you to run the framework on a disk image.

For all packages, GPG signatures exist.

• Download Version 4.1.0 (Jun 17, 2013)
• Current version (version 4.0) has been tested with:
  • AFFLIB: 3.3.6
  • libewf: libewf-20130416
• Source code from github.com
• My GPG Key: local copy or MIT's server.
• Bindings in other languages.
• See Developer's Guide for details on the source code repository.

The Sleuth Kit can be used with Autopsy, which can be downloaded here. Autopsy 3 (Windows-only) does not require an explicit Sleuth Kit Installation. Autopsy 2 requires that The Sleuth Kit be installed first.

Refer to the SleuthKitWiki for Packages and Add-ons.

Bugs

See the Support page for details on reporting bugs.

Announcements

Announcements of new releases are sent to the sleuthkit-announce and sleuthkit-users e-mail lists and the RSS feed .